// Legal

Privacy Policy

Last updated: July 2026

This policy explains how Project Pixel Studio Ltd ("we", "us") collects and uses personal data when you visit our website, submit a brief, buy a package, or use the client portal. We are the data controller under the UK GDPR and (where applicable) the EU GDPR. We provide services to clients worldwide.

What we collect

  • Account details you provide when signing up or filling out a brief (name, email, phone, business).
  • Project information you submit through the brief, bespoke enquiry, or contact form.
  • Files you upload to the client portal.
  • Payment metadata handled by Stripe (we do not see or store card numbers).
  • Website usage — Plausible (always on, no cookies, no personal data). Google Analytics 4 and Microsoft Clarity only if you accept analytics cookies.
  • Basic technical logs (IP address, user agent) for security.

Why we use it (legal basis)

  • Contract — to deliver the services you buy, run your project, invoice you, and provide support.
  • Legitimate interests — to secure the site, prevent fraud, and improve our services.
  • Consent — analytics cookies and marketing communications (you can withdraw consent at any time).
  • Legal obligation — accounting, tax, and compliance records.

Sub-processors

We use trusted third parties, each bound by a data-processing agreement:

  • Supabase / Lovable Cloud — hosting, database, authentication, file storage.
  • Stripe — payment processing (PCI-DSS Level 1).
  • Resend / Lovable Email — transactional email.
  • Cloudflare — CDN, DDoS protection, DNS.
  • Google Analytics, Microsoft Clarity, Plausible — analytics (see the cookies policy).

International transfers

Some sub-processors are outside the UK/EEA. Where required, we rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or adequacy decisions.

Retention

We keep account data while your account is active; project files for up to 24 months after completion; invoices and tax records for 7 years; analytics data for 14 months (GA4 default). Marketing emails until you unsubscribe.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent. UK/EU visitors can complain to the ICO (ico.org.uk) or their local supervisory authority. California residents have additional rights under the CCPA/CPRA. Email cameron@project-pixel.com to exercise any of these — we respond within 30 days.

Security

Data is encrypted in transit (TLS) and at rest. Access is restricted, logged and reviewed. We do not sell personal data and we never will.

Contact

Project Pixel Studio Ltd, Scotland, United Kingdom.
cameron@project-pixel.com